<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm attempting to use MDDriven configuration to activate the ECP profile for a specific SP, but I've done something wrong. I used the example at
<a href="https://wiki.shibboleth.net/confluence/display/IDP4/MetadataDrivenConfiguration">
https://wiki.shibboleth.net/confluence/display/IDP4/MetadataDrivenConfiguration</a> under "Legacy Profiles > Enabling SAML 1.1 SSO conditionally using a tag" as a starting point. I tried using this in relying-party.xml:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean parent="SAML2.ECP.MDDriven" p:postAuthenticationFlows="context-check">
<div> <property name="activationCondition"></div>
<div> <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction"></div>
<div> <constructor-arg></div>
<div> <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="https://login.oregonstate.edu/ns/profiles/saml2/sso/ECP/activate" /></div>
<div> </constructor-arg></div>
<div> <constructor-arg value="false" /></div>
<div> </bean></div>
<div> </property></div>
<div> <property name="defaultAuthenticationMethods"> </div>
<div> <list></div>
<div> <ref bean="MFASAML2Principal" /></div>
<div> <ref bean="PasswordPrincipal" /></div>
<div> </list></div>
<div> </property></div>
<span></bean></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
and this in the SP metadata:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<Extensions><br>
<mdattr:EntityAttributes></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<saml:Attribute Name="https://login.oregonstate.edu/ns/profiles/saml2/sso/ECP/activate" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<div> <saml:AttributeValue>true</saml:AttributeValue></div>
</saml:Attribute></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</mdattr:EntityAttributes><br>
</Extensions></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
But, I get the following error in idp-process.log:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2021-05-26 23:00:38,063 - 71.238.20.172 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:124] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/ecp is not active for RP configuration shibboleth.DefaultRelyingParty
(RPID urn:amazon:webservices)
<div>2021-05-26 23:00:38,078 - 71.238.20.172 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred</div>
while processing the request: InvalidProfileConfiguration</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Obviously, the activation condition isn't evaluating to true. Where did I goof? How do I create a new MD tag to trigger the activation?</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy</div>
</body>
</html>